7075cb6e4796d51166eaed9117d326a172422fdd0cc5e89cf7614d07f1e63794

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 02:31

Target

5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe
Size

97KB
MD5

5eb0c8f95903dece99ec7861db3b8e26
SHA1

dc3f66136f0f52334a30315a3210e1b1e6fbb92e
SHA256

7075cb6e4796d51166eaed9117d326a172422fdd0cc5e89cf7614d07f1e63794
SHA512

a986058e5fe8e25947bdb1946d30bf908b22679141808322133d88c86cc3807ffc6251d0dfb1e86fb7040d12d16758e554a6b81d81ad69f7993fced661cf0fad
SSDEEP

3072:5o9bMmqdPMcoH1qUK0dgDCWmdTF6xiyna/9M:5o9bkdPMcq1qp0eDju649+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2404	WerFault.exe	29

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2964	2404	5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2964	2404	5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2964	2404	5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe	30
PID 2404 wrote to memory of 2964	2404	5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5eb0c8f95903dece99ec7861db3b8e26_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 36
  2⤵
  - Program crash
  PID:2964

memory/2404-0-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/2404-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download